# CVE-2009-0557: Microsoft Office Object Record Corruption Vulnerability

Source: https://junglewise.ai/threats/cve-2009-0557-microsoft-office-object-record-corruption-vulnerability  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-06-08. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-2009-0557 · Severity: critical · CVSS 9.3 · Exploited in the wild · Published 2022-06-08

Microsoft Excel and related Office components contain an object record corruption vulnerability. Remote attackers can execute arbitrary code by tricking a user into opening a specially crafted Excel file containing a malformed record object.

Technologies: [Microsoft Office](https://junglewise.ai/threats/technologies/office). Vendors: [Microsoft](https://junglewise.ai/threats/vendors/microsoft).

## Quick answers

**Is CVE-2009-0557 exploited in the wild?** Yes. CVE-2009-0557 is known to be exploited in the wild, first recorded on 8 June 2022. Treat it as urgent.

**How severe is CVE-2009-0557?** Critical severity, with a CVSS score of 9.3, published 8 June 2022.

**Which products and versions are affected?** Microsoft Excel 2000 SP3, XP SP3, 2003 SP3, 2007 SP1, 2007 SP2; Microsoft Excel for Mac 2004, 2008; Microsoft Office Excel Viewer 2003 SP3, and unversioned; Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1, SP2; and 2 more.

**Is there a fix for CVE-2009-0557?** A patch was published on 2009-06-09: Microsoft released security bulletin MS09-021. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2009-0557 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2009-0557?** Check whether you run Microsoft Office. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Microsoft Excel 2000 SP3, XP SP3, 2003 SP3, 2007 SP1, 2007 SP2
- Microsoft Excel for Mac 2004, 2008
- Microsoft Office Excel Viewer 2003 SP3, and unversioned
- Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1, SP2
- Microsoft Open XML File Format Converter for Mac
- Microsoft Office SharePoint Server 2007 SP1, SP2

## Timeline

- 2009-06-09: patched: Microsoft released security bulletin MS09-021.
- 2022-06-08: kev added: Added to CISA Known Exploited Vulnerabilities Catalog.
- 2022-06-08: disclosed: NVD publication date.
- exploited: Reported as exploited in the wild.

## Related threats

- [Microsoft Office Outlook user warning spoofing vulnerability](https://junglewise.ai/threats/cve-2026-124194-microsoft-office-outlook-missing-user-interaction-for)
- [Microsoft Office heap-based buffer overflow](https://junglewise.ai/threats/cve-2026-122198-heap-based-buffer-overflow-in-microsoft-office-allows-an)
- [Microsoft Office heap-based buffer overflow](https://junglewise.ai/threats/cve-2026-120003-heap-based-buffer-overflow-in-microsoft-office-allows-an)
- [Microsoft Office UI security feature bypass](https://junglewise.ai/threats/cve-2026-119998-product-ui-does-not-warn-user-of-unsafe-actions-in-microsoft)
- [Microsoft Office heap-based buffer overflow](https://junglewise.ai/threats/cve-2026-116717-heap-based-buffer-overflow-in-microsoft-office-allows-an)